fix: keep ajv codegen out of flow-schema barrel

[wavekat-eason]

Problem

@wavekat/flow-schema ran ajv.compile(schema) at the top level of the package barrel (src/index.ts). Ajv builds a validator by generating JavaScript source and new Function-ing it, so importing the barrel pulled runtime code generation into the consumer's module graph.

The platform API runs on the Cloudflare Workers isolate, which disallows code-generation-from-strings. Since the compile happened at import time, the Worker crashed at boot with:

EvalError: Code generation from strings disallowed for this context
  at compileSchema
The Workers runtime failed to start.

— even though the Worker only uses the hand-written checkFlow / stampIdentity surface and never calls validateStructure. It was paying for a code path it doesn't use, just because it shared the barrel.

Fix

Move validateStructure + StructuralResult + the Ajv import/compile into a new src/structure.ts, exposed via a ./structure subpath export. The main entry (.) is now Ajv-free and safe to bundle on the edge; Node-side consumers opt into structural validation explicitly with import { validateStructure } from '@wavekat/flow-schema/structure'.

Verification

• pnpm typecheck clean; pnpm test green (79 passed).
• Built dist, then imported it under Node with --disallow-code-generation-from-strings (the same restriction the Workers isolate enforces):
  • barrel (./dist/index.js) → imports cleanly; checkFlow/stampIdentity/flowV1Schema present ✓
  • ./structure → still throws EvalError ✓ (confirms the Ajv codegen moved fully off the Worker path and is only paid when opted into)

Notes

• ./structure is Node-only; not safe to import from a Workers/edge bundle. Documented in the module header.
• Version / CHANGELOG left to release-please — this fix: commit cuts 0.0.4, which the platform then bumps to.

🤖 Generated with Claude Code